Privacy Policy & Data Protection
Your career data belongs strictly to you. This policy outlines how DreemFolio AI collects, processes, and protects your personal information in full compliance with the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA), the EU General Data Protection Regulation (GDPR), and international payment security frameworks.
Zero Payment Card Storage
Card details are handled exclusively by PayHere (PCI-DSS Level 1). We never store or see your raw card numbers or CVV.
Zero AI Training Retention
Your uploaded resumes, career records, and target job descriptions are never used to train foundation AI models.
We Never Sell Your Data
We do not sell, rent, or trade your personal career information or contact lists to recruiters, data brokers, or advertisers.
1 Introduction & Data Controller
DreemFolio AI ("DreemFolio", "we", "our", or "us") operates the SaaS platform located at dreemfolio.com, providing automated resume optimization, ATS scoring, and portfolio publishing.
Under the Personal Data Protection Act No. 9 of 2022 of Sri Lanka (PDPA) and the EU General Data Protection Regulation (GDPR), DreemFolio AI acts as the Data Controller for your account credentials, billing records, and authentication data, and as a Data Processor for user-submitted resume files and cover letters.
privacy@dreemfolio.com (Hambanthota, Sri Lanka).
2 Information We Collect
- Account Credentials: Full name, registered email address, and one-way cryptographic password hashes (salted using bcrypt).
-
Google OAuth 2.0 Information: When signing in with Google, we receive your Google ID, verified email address, full name, and avatar image URL via standard scopes (
openid,email,profile). - Resume & Career Documents: Uploaded CV documents (PDF, DOCX, TXT), employment history, education, certifications, projects, and target job postings pasted for keyword scoring.
- Transaction & Billing Metadata: Order reference ID, payment date, plan duration (1M, 3M, 6M, 12M, Lifetime), currency (LKR or USD), payment method used (e.g. Visa/MasterCard, Frimi, eZ Cash, Bank Transfer), and subscription expiry date. We do not collect or store card numbers.
- Technical Device Data: IP address, browser user-agent, operating system, and geolocation (country-level) used solely to apply Purchasing Power Parity (PPP) pricing and mitigate fraud.
3 Payment Gateway Security & Non-Storage of Financial Data
All financial transactions for subscriptions and passes are processed securely through PayHere (Private) Limited, an authorized Payment Service Provider regulated by the Central Bank of Sri Lanka:
DreemFolio AI never collects, intercepts, views, or stores your credit card numbers, debit card details, CVV/CVC codes, card expiration dates, or bank passwords. All card details are transmitted directly from your web browser to PayHere's 256-bit encrypted checkout servers. PayHere is fully certified under the Payment Card Industry Data Security Standard (PCI-DSS Level 1).
Upon successful payment, PayHere transmits an encrypted, digitally signed Instant Payment Notification (IPN) with a hash signature verifying that the payment was completed. DreemFolio AI saves only the transaction reference ID, payment status, and order total to activate your subscription quota.
4 Sri Lanka PDPA Compliance & User Privacy Rights
Under the Personal Data Protection Act No. 9 of 2022 (PDPA) of Sri Lanka, GDPR, and CCPA, every registered user is entitled to the following statutory rights:
You can request confirmation of whether we process your data and receive an export of all resumes and account information.
You may modify, correct, or update incomplete or inaccurate career information directly via your dashboard at any time.
You can delete saved cloud resumes or submit an account deletion request to erase your data permanently.
You may withdraw your consent for processing at any time without affecting the lawfulness of processing before withdrawal.
5 Google API Services User Data Policy Compliance
DreemFolio AI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements:
- We only access Google data to authenticate your identity and display your profile picture.
- We never sell, rent, or transfer your Google profile data to data brokers or advertising networks.
- We never use Google profile data to train generalized AI/ML models.
6 Generative AI Processing & Zero Training Retention
DreemFolio AI connects to enterprise generative AI APIs (such as Google Gemini) to tailor resume content and calculate ATS keyword metrics.
All data submitted to generative inference engines is transmitted over TLS 1.3 encrypted tunnels and processed ephemerally. Enterprise parameters are enforced so that your resume content, career history, and job descriptions are NEVER retained or utilized to train or fine-tune public foundation AI models.
7 Data Security & Retention Policies
- Data in Transit: All HTTP communications are strictly encrypted using TLS 1.3 with HTTPS enforcement and HSTS security headers.
- Data at Rest: Cloud resumes and candidate records are stored in secure relational databases with isolated tenant schemas and strict row-level access controls.
- File Uploads: Uploaded resume files (PDF, DOCX) are parsed entirely in ephemeral RAM buffers and purged immediately following structured data extraction.
- Retention Period: Resumes and account data remain saved until you delete them or close your account. Transaction history is retained for statutory accounting periods mandated by Sri Lankan tax regulations.
8 Cookies & Local Browser Storage
DreemFolio AI utilizes client-side localStorage solely for essential operational functionality:
saas_token: Authenticates your user session via signed JSON Web Tokens (JWT).dreemfolio_theme: Remembers your Dark / Light display mode preference.dreemfolio_country: Remembers your currency preference (LKR / USD).
We do not deploy intrusive third-party cross-site advertising trackers or tracking pixels.
9 Contact Our Data Protection Office
To exercise your rights under the Sri Lanka PDPA or international privacy frameworks, submit a formal request to our team:
Data Controller: DreemFolio AI
Operating Location: Hambanthota, Sri Lanka
Privacy Inquiries: privacy@dreemfolio.com
General Support: support@dreemfolio.com
Response Timeline: Formal privacy requests are acknowledged and fulfilled within 48 business hours.